Securing our supply chain tracker

[nsoranzo]

See:

• Bernát Gábor’s excellent guide on Python supply chain security.
• https://trailofbits.github.io/are-we-pep740-yet/

Ideas:

• Use the exclude-newer = "1 week" for [[tool.uv]] in pyproject.toml . Needs Only apply exclude-newer under dependency version constraints astral-sh/uv#18914

Tools:

• https://github.com/nsoranzo/check-pypi-metadata to check which packages don't implement Trusted Publishing yet.

Trusted publishing issues in our dependencies:

• annotated-types Use PyPI action to publish package annotated-types/annotated-types#95
• anthropic Use Trusted Publishing to upload to PyPI anthropics/anthropic-sdk-python#1568
• boto3 Support PEP 740 Digital Attestation boto/boto3#4427
• botocore Support PEP 740 Digital Attestation boto/botocore#3379
• cloudbridge Use Trusted Publishing to upload to PyPI CloudVE/cloudbridge#329
• contourpy Upload packages to PyPI using Trusted Publishing in CI contourpy/contourpy#482
• cwl-upgrader Use Trusted Publishing to upload to PyPI common-workflow-language/cwl-upgrader#211
• cwltest Use Trusted Publishing to upload to PyPI common-workflow-language/cwltest#289
• cwltool Use Trusted Publishing to upload to PyPI common-workflow-language/cwltool#2270
• cyclopts Use Trusted Publishing to upload to PyPI BrianPugh/cyclopts#811
• fsspec Switch to trusted publishing for package upload to PyPI in CI fsspec/filesystem_spec#1866
• gravity Use trusted publishing to upload to PyPI gravity#151
• gunicorn Publish package via CI benoitc/gunicorn#3409 (closed as wontfix)
• huggingface-hub Use Trusted Publishing to upload to PyPI huggingface/huggingface_hub#4236
• isort Switch to Trusted Publishing for package upload to PyPI in CI PyCQA/isort#2500
• jaraco-functools Use Trusted Publishing to upload to PyPI jaraco/jaraco.functools#37
• markdown Switch to trusted publishing for package upload to PyPI in CI Python-Markdown/markdown#1560
• markdown-it-py 🔧 Switch PyPI publishing to trusted publishing (OIDC) executablebooks/markdown-it-py#397
• mdit-py-plugins Use trusted publishing to upload to PyPI executablebooks/mdit-py-plugins#141
• mistralai ci: publish Python SDKs to PyPI with OIDC mistralai/client-python#529
• mypy Make it easier to retry in upload-pypi script python/mypy#19174
• myst-parser Use trusted publishing to upload to PyPI executablebooks/MyST-Parser#1139
• openai Use Trusted Publishing to upload to PyPI openai/openai-python#3273
• paramiko Use Trusted Publishing to upload to PyPI paramiko/paramiko#2625
• pyasn1 Switch to trusted publishing for package upload to PyPI in CI pyasn1/pyasn1#99
• pyasn1-modules Switch to Trusted Publishing for package upload to PyPI in CI pyasn1/pyasn1-modules#28
• pyreadline3 Use Trusted Publishing to upload to PyPI pyreadline3/pyreadline3#46
• python-dateutil Switch to trusted publishing for PyPI/TestPyPI dateutil/dateutil#1298
• redis Switch to Trusted Publishing for package upload to PyPI in CI redis/redis-py#4008
• regex Switch to trusted publishing for package upload to PyPI in CI mrabarnett/mrab-regex#587
• s3fs Switch to Trusted Publishing for package upload to PyPI in CI fsspec/s3fs#1017
• scipy Wheels for next release scipy/scipy#23839
• setuptools Use Trusted Publishing to upload to PyPI pypa/setuptools#5231
• sqlalchemy Use Trusted Publishing to upload to PyPI sqlalchemy/sqlalchemy#13324
• temporalio Use Trusted Publishing to upload to PyPI temporalio/sdk-python#1546
• tiktoken Use Trusted Publishing to upload to PyPI openai/tiktoken#547
• tomli Switch to Trusted Publishing for package upload to PyPI in CI hukkin/tomli#291
• tuspyserver Use Trusted Publishing to upload to PyPI edihasaj/tuspyserver#84
• uvloop Switch to Trusted Publishing for package upload to PyPI in CI MagicStack/uvloop#741
• watchdog Switch to Trusted Publishing for package upload to PyPI in CI gorakhargosh/watchdog#1166

Other issues:

• uv publish: create attestations astral-sh/uv#15618

[nsoranzo]

Stats for our dependencies (including also conditional, dev, lint, test, typecheck) as of 2026-05-20: 179 out of 478 (37.4%) packages used Trusted Publishing for their latest release.

[nsoranzo]

Small progress! As of 2026-05-29 183 out of 478 (38.3%) packages used Trusted Publishing for their latest release.